Mitaka adds a context menu to Chrome and Firefox. Select an indicator on any page, an IP address, domain, URL, file hash, CVE number, ASN, Bitcoin or Ethereum address, or a Google Analytics or AdSense ID, right-click, and it offers every service that can look that type up: VirusTotal, urlscan.io, Shodan, Censys, GreyNoise, AbuseIPDB, URLhaus, MalwareBazaar, crt.sh, the Wayback Machine, NVD and more than 50 others. It also refangs as it selects, so example[.]com and hxxp:// in a threat report become a working lookup without editing.
It is the work of Manabu Niseki (ninoseki), a Japanese threat-intelligence researcher, and has been maintained since 2018: about 1,900 stars, 18 contributors and 113 releases, the latest in August 2026. It is MIT-licensed and published on the Chrome Web Store and Firefox Add-ons, so most people never need the GitHub repository at all.
Most entries simply open the service's search page in a new tab. Four scan engines (urlscan.io, VirusTotal, Hybrid Analysis and Browserling) can submit a URL for analysis, and the first three need your own API key, stored locally in the browser. The author states the extension collects nothing, and the source agrees.
- Repository: github.com/ninoseki/mitaka
- Licence: MIT (MIT License)
- Language: TypeScript. Stars: 1,884. Forks: 194. Last push: Oct 21, 2026.
- Scan: safe, Oct 28, 2026, commit 44d3b74
Who it is for
SOC analysts, incident responders and threat-intel researchers who read reports full of indicators all day, plus journalists and fact-checkers verifying domains and wallets in a story.
Getting started
1. Install from the Chrome Web Store (Edge and other Chromium browsers can use it too)
open https://chromewebstore.google.com/detail/mitaka/bfjbejmeoibbdpfdbmbacmefcbannnbg2. Or install from Firefox Add-ons, and allow access to all websites when asked
open https://addons.mozilla.org/en-US/firefox/addon/mitaka/3. Or build it yourself from source (Node.js 24) and load the unpacked extension
git clone https://github.com/ninoseki/mitaka && cd mitaka && npm ci && npm run buildScans submitted to urlscan.io default to public visibility, so anyone can see the URL you scanned. If you are checking internal links or anything sensitive, switch it to unlisted or private on the options page before your first scan.
Safety scan
We cloned ninoseki/mitaka at commit 44d3b74 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across 161 files. The hosts the scan lists are the 65-plus lookup services themselves. The extension asks only for contextMenus, storage and notifications; its content script reads the text you select so it can build the menu, and the only network calls in the source are the three scan engines you give a key to.
- package-lock.json has 31 known advisories, 4 of them critical, and all four are in build and test tooling that never ships in the extension. form-data 2.3.3 arrives through request, pulled in by coveralls, the coverage uploader. shell-quote comes from npm-run-all2, the script runner. Both tinypool advisories come from oxfmt, the code formatter. The highs (js-yaml, sharp, brace-expansion, vite and others) are dev dependencies of the same kind; nanoid and source-map-js sit under PostCSS and the Vue compiler, which run at build time.
- One install hook, postinstall running wxt prepare, which generates the extension framework's type definitions for development. It only runs if you build from source.
- Two workflows, CI and Release, with no pull_request_target and every third-party action pinned to a commit. The release job builds and uploads to the Chrome Web Store and Firefox Add-ons from a published GitHub release.
- Licence and contributing guide present; no security policy, Dependabot, CodeQL or code of conduct. OpenSSF Scorecard rates it 3.8, mostly for missing branch protection and code review on a one-maintainer project.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 0 of 4 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, www.virustotal.com, www.hybrid-analysis.com, urlscan.io. No URLs to bare IP addresses. |
| Known vulnerabilities | 31 advisories across 530 pinned packages: 4 critical, 12 high, 14 moderate, 1 low. package-lock.json: 545 packages, 31 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 3.8 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (1)
package.jsonpostinstall:wxt prepare
Worst known vulnerabilities (24 of 31)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-fjxv-7rqg-78g4 | critical | form-data@2.3.3 | form-data uses unsafe random function in form-data for choosing boundary |
| GHSA-pqg4-j6r4-53mv | critical | shell-quote@1.8.4 | shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token |
| GHSA-5gmw-xhrv-c9v3 | critical | tinypool@2.1.0 | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution |
| GHSA-85c8-ppgw-ccpr | critical | tinypool@2.1.0 | Tinypool: Prototype Pollution Gadget to RCE in run() options |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@5.0.9 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@5.0.9 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-hmw2-7cc7-3qxx | high | form-data@2.3.3 | form-data: CRLF injection in form-data via unescaped multipart field names and filenames |
| GHSA-2883-xcg3-v3hh | high | js-yaml@3.14.2 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@3.14.2 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@3.14.2 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.16 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.35.3 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-wq5f-xc86-pv6w | high | sharp@0.35.3 | sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
| GHSA-395f-4hp3-45gv | high | shell-quote@1.8.4 | shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) |
| GHSA-68fv-2mgg-jv7q | high | source-map-js@1.2.1 | source-map-js allows event-loop denial of service through indexed source-map section offsets |
| GHSA-587h-7wmj-h5pm | high | vite@8.0.16 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-p498-v437-472g | moderate | @humanfs/node@0.16.7 | humanfs: Recursive copy follows symlinked files and copies data from outside the source tree |
| GHSA-qxg6-89mg-rqv8 | moderate | @vitest/mocker@4.1.11 | Vitest: Code injection via unauthenticated manual mock registration |
| GHSA-xp26-3454-mjgp | moderate | @vitest/mocker@4.1.11 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix |
| GHSA-q2hr-2g5m-vwhr | moderate | brace-expansion@5.0.9 | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
| GHSA-h67p-54hq-rp68 | moderate | js-yaml@3.14.2 | JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
| GHSA-rj75-hqrm-r3gf | moderate | postcss-selector-parser@7.1.4 | PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
| GHSA-4mjr-xmp4-gh2g | moderate | qs@6.5.5 | qs: Denial of Service via Attacker Controlled isBuffer |
| GHSA-6rw7-vpxm-498p | moderate | qs@6.5.5 | qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion |
By the numbers
| Stars | 1,884 |
|---|---|
| Forks | 194 |
| Contributors | 18 |
| Commits | 1,511 |
| Open issues | 0 |
| Open pull requests | 10 |
| Releases | 113 |
| Latest release | v2.10.1 |
| Licence | MIT |
| Main language | TypeScript |
| Project age | 8 years |
| Last push | Oct 21, 2026 |
| Tracked files | 161 |
| Lines of code | 5,702 |
| Checkout size | 902 KB |
Lines by language: TypeScript 4,871, Vue 310, Markdown 268, YAML 132, JSON 104, HTML 14.
Questions
Is Mitaka free?
Yes. Mitaka is MIT-licensed and free on both the Chrome Web Store and Firefox Add-ons. Most of the services it links to have free search pages; the scan features for VirusTotal, urlscan.io and Hybrid Analysis need an API key from each, and their free tiers are enough for occasional use.
Does Mitaka send what I select anywhere?
No, not until you click a menu item. Selecting text only builds the menu inside your browser. Clicking a search opens that service in a new tab with the indicator in the URL, and clicking a scan submits it with your own API key. Settings sync through your browser account; API keys stay on the device.
Is it okay to look up indicators from a threat report or incident?
Looking up public indicators is what these services exist for. Take care with anything from your own organisation's incident: a public urlscan.io scan or a VirusTotal upload can tip off an attacker or expose internal URLs, so use private visibility, and follow your employer's rules on sharing data with third parties.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.